startup-trust-guard 0.1.0__tar.gz

startup_trust_guard-0.1.0/LICENSE

@@ -0,0 +1,24 @@
+MIT License
+
+Copyright (c) 2026 hao li
+
+Bundled CPython tomllib modules (_toml_*.py):
+Copyright (c) 2021 Taneli Hukkinen (MIT; licensed to PSF under a Contributor Agreement)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

startup_trust_guard-0.1.0/PKG-INFO

@@ -0,0 +1,77 @@
+Metadata-Version: 2.4
+Name: startup-trust-guard
+Version: 0.1.0
+Summary: Inspect agent startup instructions and configuration trust
+Author: hao li
+License: MIT
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# startup-trust-guard
+
+A website can download AGENTS.md or CLAUDE.md into Downloads, where an agent
+may later treat it as trusted instructions. Agent configuration can also be
+changed to add an MCP server, redirect a provider URL, or disable approvals.
+This tool reports startup directory and config baseline risks before you start.
+
+Python 3.9+; standard library only, no runtime or build dependencies, no network.
+Install with `python3 -m pip install --no-build-isolation .`, or run directly:
+
+```sh
+PYTHONPATH=src python3 -m startup_trust_guard.cli check . --json
+startup-trust-guard check ~/Downloads
+startup-trust-guard config-check
+startup-trust-guard config-check --codex-config ./config.toml --claude-settings ./settings.json
+startup-trust-guard baseline save
+startup-trust-guard baseline save --out ./baseline.json
+startup-trust-guard baseline show
+startup-trust-guard baseline show --path ./baseline.json
+startup-trust-guard trust add ./AGENTS.md
+startup-trust-guard trust list
+```
+
+The scan reads AGENTS.md, CLAUDE.md, GEMINI.md and .cursorrules at the top
+level and directly inside .claude/ and .cursor/, plus .claude/settings.json
+as configuration. It does not recurse further. Git-tracked and explicitly
+trusted files are OK unless suspicious content wins. Downloads paths and
+recent untracked files are HIGH. Older untracked files are conservatively
+HIGH too. Suspicious shell pipelines, provider overrides, approval bypasses,
+destructive commands, credential references and remote MCP definitions are
+CRITICAL. Symlinks are HIGH and are never followed into credential files.
+Content matching is heuristic: quoted examples can trigger findings, and
+obfuscated instructions may evade detection.
+
+Config checks read only ~/.codex/config.toml and ~/.claude/settings.json, or
+the explicitly supplied alternatives. MCP entries, provider URL overrides,
+and disabled approvals are HIGH. MCP name and provider URL changes against
+the default baseline are CRITICAL (ADDED, REMOVED or CHANGED). Baselines
+store URL SHA-256 fingerprints instead of raw URLs because URLs can contain
+secrets. `baseline show` displays keys and fingerprint markers, never values.
+Python 3.9/3.10 use a bundled copy of the MIT-licensed CPython standard
+library TOML parser; Python 3.11+ uses tomllib directly. No external TOML
+package is required.
+
+Findings contain names, severities and rule names only, never file contents
+or configuration values. Long token-like strings in names are redacted too.
+No credential files are opened. Normal checks are read-only. `trust add`
+explicitly writes the trust registry under ~/.config/startup-trust-guard/;
+`baseline save` explicitly writes its baseline there or at --out.
+Custom baselines can be shown with --path; automatic config comparison uses
+the default baseline. No files are written elsewhere by the tool.
+
+Exit codes: **0** means no HIGH/CRITICAL findings (including no config files),
+**1** means findings require review, **2** means a usage, input or I/O error.
+`check --json` returns an object with `dir` and `findings`; `config-check`
+also supports --json. Configuration values are never included in either format.
+
+This tool does not block an agent, quarantine or delete files, or auto-fix
+configuration. agent-guard guards tool calls; mcp-audit audits MCP servers.
+startup-trust-guard guards the startup directory and config baseline.
+
+Run tests from the project root:
+
+```sh
+python3 -m unittest discover -s tests -v
+```

startup_trust_guard-0.1.0/README.md

@@ -0,0 +1,66 @@
+# startup-trust-guard
+
+A website can download AGENTS.md or CLAUDE.md into Downloads, where an agent
+may later treat it as trusted instructions. Agent configuration can also be
+changed to add an MCP server, redirect a provider URL, or disable approvals.
+This tool reports startup directory and config baseline risks before you start.
+
+Python 3.9+; standard library only, no runtime or build dependencies, no network.
+Install with `python3 -m pip install --no-build-isolation .`, or run directly:
+
+```sh
+PYTHONPATH=src python3 -m startup_trust_guard.cli check . --json
+startup-trust-guard check ~/Downloads
+startup-trust-guard config-check
+startup-trust-guard config-check --codex-config ./config.toml --claude-settings ./settings.json
+startup-trust-guard baseline save
+startup-trust-guard baseline save --out ./baseline.json
+startup-trust-guard baseline show
+startup-trust-guard baseline show --path ./baseline.json
+startup-trust-guard trust add ./AGENTS.md
+startup-trust-guard trust list
+```
+
+The scan reads AGENTS.md, CLAUDE.md, GEMINI.md and .cursorrules at the top
+level and directly inside .claude/ and .cursor/, plus .claude/settings.json
+as configuration. It does not recurse further. Git-tracked and explicitly
+trusted files are OK unless suspicious content wins. Downloads paths and
+recent untracked files are HIGH. Older untracked files are conservatively
+HIGH too. Suspicious shell pipelines, provider overrides, approval bypasses,
+destructive commands, credential references and remote MCP definitions are
+CRITICAL. Symlinks are HIGH and are never followed into credential files.
+Content matching is heuristic: quoted examples can trigger findings, and
+obfuscated instructions may evade detection.
+
+Config checks read only ~/.codex/config.toml and ~/.claude/settings.json, or
+the explicitly supplied alternatives. MCP entries, provider URL overrides,
+and disabled approvals are HIGH. MCP name and provider URL changes against
+the default baseline are CRITICAL (ADDED, REMOVED or CHANGED). Baselines
+store URL SHA-256 fingerprints instead of raw URLs because URLs can contain
+secrets. `baseline show` displays keys and fingerprint markers, never values.
+Python 3.9/3.10 use a bundled copy of the MIT-licensed CPython standard
+library TOML parser; Python 3.11+ uses tomllib directly. No external TOML
+package is required.
+
+Findings contain names, severities and rule names only, never file contents
+or configuration values. Long token-like strings in names are redacted too.
+No credential files are opened. Normal checks are read-only. `trust add`
+explicitly writes the trust registry under ~/.config/startup-trust-guard/;
+`baseline save` explicitly writes its baseline there or at --out.
+Custom baselines can be shown with --path; automatic config comparison uses
+the default baseline. No files are written elsewhere by the tool.
+
+Exit codes: **0** means no HIGH/CRITICAL findings (including no config files),
+**1** means findings require review, **2** means a usage, input or I/O error.
+`check --json` returns an object with `dir` and `findings`; `config-check`
+also supports --json. Configuration values are never included in either format.
+
+This tool does not block an agent, quarantine or delete files, or auto-fix
+configuration. agent-guard guards tool calls; mcp-audit audits MCP servers.
+startup-trust-guard guards the startup directory and config baseline.
+
+Run tests from the project root:
+
+```sh
+python3 -m unittest discover -s tests -v
+```

startup_trust_guard-0.1.0/pyproject.toml

@@ -0,0 +1,20 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "startup-trust-guard"
+version = "0.1.0"
+description = "Inspect agent startup instructions and configuration trust"
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "hao li" }]
+dependencies = []
+
+[project.scripts]
+startup-trust-guard = "startup_trust_guard.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["startup_trust_guard*"]

startup_trust_guard-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

startup_trust_guard-0.1.0/src/startup_trust_guard/__init__.py

@@ -0,0 +1,2 @@
+"""Startup directory and configuration trust inspection."""
+__version__ = "0.1.0"